Skip to content

Commit a46eddc

Browse files
Danil42RussiaDanil42Russia
authored
chore(ci): add Zizmor check (#299)
1 parent 9827327 commit a46eddc

8 files changed

Lines changed: 142 additions & 28 deletions

File tree

‎.github/workflows/check-zizmor.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Check Zizmor
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
paths:
8+
- ".github/**"
9+
push:
10+
branches:
11+
- main
12+
paths:
13+
- ".github/**"
14+
workflow_dispatch:
15+
16+
concurrency:
17+
group: ${{ github.workflow }}-${{ github.ref }}
18+
cancel-in-progress: true
19+
20+
permissions: {}
21+
22+
jobs:
23+
zizmor:
24+
name: Check Zizmor
25+
runs-on: ubuntu-latest
26+
27+
permissions:
28+
contents: read
29+
30+
steps:
31+
- name: Checkout repository
32+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
33+
with:
34+
persist-credentials: false
35+
36+
- name: Run zizmor
37+
uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
38+
with:
39+
persona: "auditor"

‎.github/workflows/grammars.yml‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ on:
1212
paths:
1313
- "server/src/languages/**/tree-sitter-**/**"
1414

15+
permissions: {}
16+
1517
concurrency:
1618
group: ${{ github.workflow }}-${{ github.ref }}
1719
cancel-in-progress: true
@@ -23,6 +25,10 @@ jobs:
2325
tree-sitter-grammars:
2426
name: Building tree-sitter (${{ matrix.os }})
2527
runs-on: ${{ matrix.os }}
28+
29+
permissions:
30+
contents: read
31+
2632
strategy:
2733
fail-fast: false
2834
matrix:
@@ -32,7 +38,9 @@ jobs:
3238
- macos-latest
3339
steps:
3440
- name: Fetch Sources
35-
uses: actions/checkout@v6
41+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
42+
with:
43+
persist-credentials: false
3644

3745
- name: Enable Corepack
3846
if: matrix.os == 'windows-latest'
@@ -43,13 +51,13 @@ jobs:
4351
run: corepack enable
4452

4553
- name: Setup Node.js 22.x
46-
uses: actions/setup-node@v6
54+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
4755
with:
4856
node-version: 22.x
4957
cache: "yarn"
5058

5159
- name: Setup EMSDK
52-
uses: pyodide/setup-emsdk@ca2dd8aef8c2a0e11743c5c36f0b430ddb694b5c # v15
60+
uses: emscripten-core/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16
5361
env:
5462
EMSDK_VERSION: 4.0.15
5563
with:

‎.github/workflows/linter.yml‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,21 +8,34 @@ on:
88
branches:
99
- main
1010

11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
14+
15+
permissions: {}
16+
1117
env:
1218
HUSKY: 0
1319

1420
jobs:
1521
linter:
22+
name: Linter checks
1623
runs-on: ubuntu-latest
24+
25+
permissions:
26+
contents: read
27+
1728
steps:
1829
- name: Fetch Sources
19-
uses: actions/checkout@v6
30+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
31+
with:
32+
persist-credentials: false
2033

2134
- name: Enable Corepack
2235
run: corepack enable
2336

2437
- name: Setup Node.js 22.x
25-
uses: actions/setup-node@v6
38+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
2639
with:
2740
node-version: 22.x
2841
cache: "yarn"

‎.github/workflows/release.yml‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,24 +3,34 @@ name: Build and Attach Release Assets
33
on:
44
workflow_dispatch:
55

6+
concurrency:
7+
group: ${{ github.workflow }}-${{ github.ref }}
8+
cancel-in-progress: true
9+
10+
permissions: {}
11+
612
env:
713
HUSKY: 0
814

915
jobs:
1016
build-and-attach:
17+
name: Build and Attach Release Assets
1118
runs-on: ubuntu-latest
19+
1220
permissions:
13-
contents: write
21+
contents: write # upload release assets
1422

1523
steps:
1624
- name: Fetch Sources
17-
uses: actions/checkout@v6
25+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
26+
with:
27+
persist-credentials: false
1828

1929
- name: Enable Corepack
2030
run: corepack enable
2131

2232
- name: Setup Node.js 22.x
23-
uses: actions/setup-node@v6
33+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
2434
with:
2535
node-version: 22.x
2636
cache: "yarn"
@@ -31,7 +41,7 @@ jobs:
3141
run: yarn install --immutable
3242

3343
- name: Setup EMSDK
34-
uses: pyodide/setup-emsdk@ca2dd8aef8c2a0e11743c5c36f0b430ddb694b5c # v15
44+
uses: emscripten-core/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16
3545
env:
3646
EMSDK_VERSION: 4.0.15
3747
with:

‎.github/workflows/security.yml‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,18 +8,31 @@ on:
88
branches:
99
- main
1010

11+
concurrency:
12+
group: ${{ github.workflow }}-${{ github.ref }}
13+
cancel-in-progress: true
14+
15+
permissions: {}
16+
1117
jobs:
1218
security:
19+
name: Security checks
1320
runs-on: ubuntu-latest
21+
22+
permissions:
23+
contents: read
24+
1425
steps:
1526
- name: Fetch Sources
16-
uses: actions/checkout@v6
27+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
28+
with:
29+
persist-credentials: false
1730

1831
- name: Enable Corepack
1932
run: corepack enable
2033

2134
- name: Setup Node.js 22.x
22-
uses: actions/setup-node@v6
35+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
2336
with:
2437
node-version: 22.x
2538
cache: "yarn"

‎.github/workflows/sync-tolk-grammar.yml‎

Lines changed: 28 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,10 @@ on:
1414
default: false
1515
type: boolean
1616

17+
permissions: {}
18+
1719
concurrency:
18-
group: grammar-sync
20+
group: ${{ github.workflow }}-${{ github.ref }}
1921
cancel-in-progress: true
2022

2123
env:
@@ -24,21 +26,25 @@ env:
2426

2527
jobs:
2628
sync-grammar:
29+
name: Sync Tolk Grammar
2730
runs-on: ubuntu-latest
2831
if: github.repository == 'ton-blockchain/ton-language-server'
32+
2933
permissions:
3034
contents: read
3135

3236
steps:
3337
- name: Checkout source repository
34-
uses: actions/checkout@v6
38+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
3539
with:
40+
persist-credentials: false
3641
fetch-depth: 0
3742
path: source
3843

3944
- name: Checkout target repository
40-
uses: actions/checkout@v6
45+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
4146
with:
47+
persist-credentials: false
4248
repository: ${{ env.GRAMMAR_REPO }}
4349
token: ${{ secrets.GRAMMAR_SYNC_TOKEN }}
4450
path: target
@@ -50,6 +56,8 @@ jobs:
5056
git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
5157
5258
- name: Sync grammar files
59+
env:
60+
SOURCE_GRAMMAR_PATH: ${{ env.GRAMMAR_PATH }}
5361
run: |
5462
rsync -a --delete \
5563
--exclude='.git' \
@@ -58,7 +66,7 @@ jobs:
5866
--exclude='build' \
5967
--exclude='target' \
6068
--exclude='.DS_Store' \
61-
"source/${{ env.GRAMMAR_PATH }}/" "target/"
69+
"source/${SOURCE_GRAMMAR_PATH}/" "target/"
6270
6371
- name: Check for changes
6472
id: changes
@@ -77,6 +85,8 @@ jobs:
7785
- name: Create commit and push
7886
if: steps.changes.outputs.has_changes == 'true' || github.event.inputs.force_sync == 'true'
7987
working-directory: target
88+
env:
89+
FORCE_SYNC: ${{ github.event.inputs.force_sync || 'false' }}
8090
run: |
8191
# Get the latest commit info from source
8292
cd ../source
@@ -87,7 +97,7 @@ jobs:
8797
cd ../target
8898
8999
# Create commit message
90-
if [ "${{ github.event.inputs.force_sync }}" = "true" ]; then
100+
if [ "$FORCE_SYNC" = "true" ]; then
91101
SYNC_MSG="chore: force sync from ton-language-server@${COMMIT_SHA:0:7}"
92102
else
93103
SYNC_MSG="sync: ${COMMIT_MSG}"
@@ -104,14 +114,19 @@ jobs:
104114
git push origin main
105115
106116
- name: Create summary
117+
env:
118+
FORCE_SYNC: ${{ github.event.inputs.force_sync || 'false' }}
119+
HAS_CHANGES: ${{ steps.changes.outputs.has_changes }}
120+
TARGET_GRAMMAR_REPO: ${{ env.GRAMMAR_REPO }}
121+
TRIGGER_EVENT: ${{ github.event_name }}
107122
run: |
108-
echo "## Grammar Sync Summary" >> $GITHUB_STEP_SUMMARY
109-
echo "" >> $GITHUB_STEP_SUMMARY
110-
if [ "${{ steps.changes.outputs.has_changes }}" = "true" ] || [ "${{ github.event.inputs.force_sync }}" = "true" ]; then
111-
echo "✅ Grammar successfully synced to [${{ env.GRAMMAR_REPO }}](https://github.com/${{ env.GRAMMAR_REPO }})" >> $GITHUB_STEP_SUMMARY
112-
echo "" >> $GITHUB_STEP_SUMMARY
113-
echo "**Source commit:** $(cd source && git rev-parse HEAD)" >> $GITHUB_STEP_SUMMARY
114-
echo "**Trigger:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
123+
echo "## Grammar Sync Summary" >> "$GITHUB_STEP_SUMMARY"
124+
echo "" >> "$GITHUB_STEP_SUMMARY"
125+
if [ "$HAS_CHANGES" = "true" ] || [ "$FORCE_SYNC" = "true" ]; then
126+
echo "✅ Grammar successfully synced to [${TARGET_GRAMMAR_REPO}](https://github.com/${TARGET_GRAMMAR_REPO})" >> "$GITHUB_STEP_SUMMARY"
127+
echo "" >> "$GITHUB_STEP_SUMMARY"
128+
echo "**Source commit:** $(cd source && git rev-parse HEAD)" >> "$GITHUB_STEP_SUMMARY"
129+
echo "**Trigger:** $TRIGGER_EVENT" >> "$GITHUB_STEP_SUMMARY"
115130
else
116-
echo "ℹ️ No changes to sync" >> $GITHUB_STEP_SUMMARY
131+
echo "ℹ️ No changes to sync" >> "$GITHUB_STEP_SUMMARY"
117132
fi

‎.github/workflows/tests.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88
branches:
99
- master
1010

11+
permissions: {}
12+
1113
concurrency:
1214
group: ${{ github.workflow }}-${{ github.ref }}
1315
cancel-in-progress: true
@@ -19,6 +21,10 @@ jobs:
1921
tests:
2022
name: Test (${{ matrix.os }})
2123
runs-on: ${{ matrix.os }}
24+
25+
permissions:
26+
contents: read
27+
2228
strategy:
2329
fail-fast: false
2430
matrix:
@@ -28,7 +34,9 @@ jobs:
2834
- macos-latest
2935
steps:
3036
- name: Fetch Sources
31-
uses: actions/checkout@v6
37+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
38+
with:
39+
persist-credentials: false
3240

3341
- name: Enable Corepack
3442
if: matrix.os == 'windows-latest'
@@ -39,7 +47,7 @@ jobs:
3947
run: corepack enable
4048

4149
- name: Setup Node.js 22.x
42-
uses: actions/setup-node@v6
50+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
4351
with:
4452
node-version: 22.x
4553
cache: "yarn"

‎.github/workflows/unit-tests.yml‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,8 @@ on:
88
branches:
99
- main
1010

11+
permissions: {}
12+
1113
concurrency:
1214
group: ${{ github.workflow }}-${{ github.ref }}
1315
cancel-in-progress: true
@@ -19,6 +21,10 @@ jobs:
1921
tests:
2022
name: Test (${{ matrix.os }})
2123
runs-on: ${{ matrix.os }}
24+
25+
permissions:
26+
contents: read
27+
2228
strategy:
2329
fail-fast: false
2430
matrix:
@@ -28,7 +34,9 @@ jobs:
2834
- macos-latest
2935
steps:
3036
- name: Fetch Sources
31-
uses: actions/checkout@v6
37+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
38+
with:
39+
persist-credentials: false
3240

3341
- name: Enable Corepack
3442
if: matrix.os == 'windows-latest'
@@ -39,7 +47,7 @@ jobs:
3947
run: corepack enable
4048

4149
- name: Setup Node.js 22.x
42-
uses: actions/setup-node@v6
50+
uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
4351
with:
4452
node-version: 22.x
4553
cache: "yarn"

0 commit comments

Comments
 (0)